Atlassian SourceTree 0.5a < 3.0.17 Multiple remote code execution vulnerabilities

The version of Atlassian SourceTree installed on the remote Windows host is version 0.5a prior to 3.0.17. It is, therefore, affected by multiple remote code execution vulnerabilities. - An option injection vulnerability exists in the git submodule component. An unauthenticated, remote attacker ca...

March 12, 2019—KB4489878 (Monthly Rollup)

None None...

March 12, 2019—KB4489886 (OS Build 16299.1029)

None None...

CVE-2018-20236

There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system...

CVE-2018-20236

There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system...

CVE-2018-20236

CVE-2018-20236 affects Sourcetree for Windows: a URI-handling vulnerability in versions older than 3.0.10 allows unauthenticated remote attackers to supply a malicious URI that yields code execution on the victim’s system. Affected: Sourcetree for Windows before 3.0.10 (0.5a–3.0.9). Remediation: ...

CVE-2018-17425

WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...

CVE-2018-17426

WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...

CVE-2018-17425

WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...

CVE-2018-17426

WUZHI CMS 4.1.0 is affected by a stored XSS vulnerability in the Extension module, specifically the "SMS in station" field under index.php?m=core. The issue is caused by improper input handling in that field, enabling arbitrary HTML/JS injection. No exploit details or remediation are provided in ...

CVE-2018-17425

WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...

CVE-2019-3778

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

CVE-2019-9625

DirectAdmin 1.55 is vulnerable to a Cross-Site Request Forgery (CSRF) via the CMD_ACCOUNT_ADMIN URI, enabling an attacker to create a new admin account. The flaw is triggered in scenarios where an authenticated admin visits a crafted page or form that issues a POST to /CMD_ACCOUNT_ADMIN, as descr...

CVE-2019-9625

JBMC DirectAdmin 1.55 allows CSRF via the /CMDACCOUNTADMIN URI to create a new admin account...

CVE-2019-9613

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadVideo URI...

CVE-2019-9617

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadFile URI...

CVE-2019-9570

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

Design/Logic Flaw

Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI...

CVE-2019-9552

CVE-2019-9552 affects Eloan V3.0 (through 2018-09-20). The vulnerability allows remote attackers to list files by directly requesting the p2p/api/, p2p/lib/, or p2p/images/ URIs. The documents do not provide a root-cause analysis, affected software versions beyond the stated release window, or re...

Cross site request forgery (csrf)

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935...